Solved Windows 7 popup not genuine, error 0x8004fe22

JakePC

New member
Local time
9:55 AM
Messages
13
Hi there,

Recently I've got this annoying popup saying "This computer is not running genuine Windows", but of course it is! I've tried re-activating with the product key, although it tells me it's successfully activated, the not genuine message just won't go away.

Anyway, below is the output of MGADiag, could someone help please?

Code:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE22
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-XD3V4-QHXT4-PQ926
Windows Product Key Hash: vD4yA91c8xY786Blb/rnQX0zq7U=
Windows Product ID: 00359-OEM-8703827-54272
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {10C5DBFB-4737-4FDD-BA4F-5CAEACBCCB73}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150525-0603
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{10C5DBFB-4737-4FDD-BA4F-5CAEACBCCB73}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-PQ926</PKey><PID>00359-OEM-8703827-54272</PID><PIDType>3</PIDType><SID>S-1-5-21-306632682-3253932108-1278027814</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>4001</Version><SMBIOSVersion major="2" minor="6"/><Date>20120420000000.000000+000</Date></BIOS><HWID>4B6A3A07018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: 586bc076-c93d-429a-afe5-a69fbc644e88
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00174-038-254272-02-2052-7601.0000-1712015
Installation ID: 019405491393123205102430545475614764092626140035191214
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: PQ926
License Status: Initial grace period
Time remaining: 36480 minute(s) (25 day(s))
Remaining Windows rearm count: 2
Trusted time: 21/06/2015 19:12:49

Windows Activation Technologies-->
HrOffline: 0x8004FE22
HrOnline: N/A
HealthStatus: 0x0002000000000000
Event Time Stamp: 6:21:2015 17:16
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppuinotify


HWID Data-->
HWID Hash Current: NAAAAAIABAABAAEAAAACAAAAAQABAAEAln0uBHcW4i1iNErd4NvqAhgZVoWygnPYMKmWYw==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG            ALASKA        A M I
  SSDT            IdeRef        IdeTable
  SSDT            IdeRef        IdeTable
  SSDT            IdeRef        IdeTable
  BGRT            ALASKA        A M I

I see that the report shows "Tampered Service sppuinotify", so I tried the following commands in the cmd:

NET START SPPUINOTIFY
SC QC SPPUINOTIFY
SC QUERYEX SPPUINOTIFY


It showed some system errors, is this where the problem is? Thank you for your help in advance.

Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>NET START SPPUINOTIFY
The SPP Notification Service service is starting.
The SPP Notification Service service could not be started.

A system error has occurred.

System error 2 has occurred.

The system cannot find the file specified.


C:\Windows\system32>SC QC SPPUINOTIFY
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SPPUINOTIFY
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Windows\system32\svchost.exe -k LocalService
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : SPP Notification Service
        DEPENDENCIES       : EventSystem
        SERVICE_START_NAME : NT AUTHORITY\LocalService

C:\Windows\system32>SC QUERYEX SPPUINOTIFY

SERVICE_NAME: SPPUINOTIFY
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 2  (0x2)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 0
        FLAGS              :
 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
This probably means that the related dll files are corrupt...


SFC -System File Checker - Instructions

Click on Start > All Programs > Accessories

Right-click onthe Command Prompt entry

Select Run as Administrator and accept the UAC prompt- the Elevated Command Prompt window should pop up.

At the Commandprompt, type

SFC /SCANNOW

and hit the Enterkey

Wait for the scanto finish - make a note of any error messages - and then reboot.



Upload theCBS.log file (compressed, please!) to your reply - also post a new MGADiag report.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Thank you very much, Noel.

Corrupted files? I hope it's not something serious.. :(

I have run the command below,

SFC /SCANNOW

and it gives me this "
Windows Resource Protection found corrupt files but was unable to fix some of them". I have attached the CBS.log file.

Also,
a new MGADiag report is below. Thanks again for your help.

Code:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE22
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-XD3V4-QHXT4-PQ926
Windows Product Key Hash: vD4yA91c8xY786Blb/rnQX0zq7U=
Windows Product ID: 00359-OEM-8703827-54272
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {10C5DBFB-4737-4FDD-BA4F-5CAEACBCCB73}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150525-0603
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{10C5DBFB-4737-4FDD-BA4F-5CAEACBCCB73}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-PQ926</PKey><PID>00359-OEM-8703827-54272</PID><PIDType>3</PIDType><SID>S-1-5-21-306632682-3253932108-1278027814</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>4001</Version><SMBIOSVersion major="2" minor="6"/><Date>20120420000000.000000+000</Date></BIOS><HWID>4B6A3A07018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: 586bc076-c93d-429a-afe5-a69fbc644e88
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00174-038-254272-02-2052-7601.0000-1712015
Installation ID: 019405491393123205102430545475614764092626140035191214
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: PQ926
License Status: Licensed
Remaining Windows rearm count: 2
Trusted time: 22/06/2015 19:38:59

Windows Activation Technologies-->
HrOffline: 0x8004FE22
HrOnline: N/A
HealthStatus: 0x0002000000000000
Event Time Stamp: 6:21:2015 17:16
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppuinotify


HWID Data-->
HWID Hash Current: NAAAAAIABAABAAEAAAACAAAAAQABAAEAln0uBHcW4i1iNErd4NvqAhgZVoWygnPYMKmWYw==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG            ALASKA        A M I
  SSDT            IdeRef        IdeTable
  SSDT            IdeRef        IdeTable
  SSDT            IdeRef        IdeTable
  BGRT            ALASKA        A M I



 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
The only errors that SFC found are these...
Code:
 Line 13640: 2015-06-22 19:21:23, Info                  CSI    00000338 [SR] Repairing 1 components
 Line 13641: 2015-06-22 19:21:23, Info                  CSI    00000339 [SR] Beginning Verify and Repair transaction
 Line 13644: 2015-06-22 19:21:23, Info                  CSI    0000033b [SR] Cannot repair member file [l:24{12}]"utc.app.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.1.7601.18869, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 13647: 2015-06-22 19:21:23, Info                  CSI    0000033d [SR] Cannot repair member file [l:66{33}]"telemetry.ASM-WindowsDefault.json" of Microsoft-Windows-Unified-Telemetry-Client, Version = 6.1.7601.18869, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
... these are the result of MS forgetting to tag these two files as variables, rather than static - and can be ignored.
If you want to 'fix' them, the best option is to uninstall the borked update (KB3068708) and then hide it when it reappears in the update list. You'll be offered the 'fixed' update when MS gets around to it :(

it looks like the files themselves are OK - so it may be some of the registry entries that are the problem.
The only error that I can see in the CBS log is this...
Code:
2015-06-21 03:14:48, Info                  CBS    Starting TrustedInstaller finalization.
2015-06-21 03:14:48, Error                 CSI    00000001 (F) HRESULT_FROM_WIN32(19) #2# from UnloadStore(target = NULL)
[gle=0x80004005]
2015-06-21 12:44:54, Info                  CBS    Starting TrustedInstaller initialization.
2015-06-21 12:44:54, Info                  CBS    Loaded Servicing Stack v6.1.7601.18766 with Core: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.18766_none_675144b3de10d6f7\cbscore.dll
2015-06-21 12:44:54, Info                  CSI    [EMAIL="00000001@2015/6/21:11:44:54.918"]00000001@2015/6/21:11:44:54.918[/EMAIL] WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7feee9cf0dd @0x7feeec898b5 @0x7feeec534e3 @0xfffce97c @0xfffcd799 @0xfffcdb2f)
...it's not one I recall seeing before, so I don't have a quick fix :(

Let's have a closer look at the registry...
Please downloadand save the CheckSUR tool from http://support.microsoft.com/kb/947821

(you'll need tolook in the details for Windows 7, downloading from the Microsoft DownloadCenter)



Run it - The toolcan take anywhere from 5 mins to a couple of hours to run (or 'Install')depending on how much it has to do, and may exit silently - it may appear tofreeze for most of that time, but be patient.

The result islogged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file



Then zip theCheckSUR.log and upload it to your reply.

 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Thank you for keeping trying, Noel.

Yes, I did wonder if it's the registry that's causing the problems, but I never use registry cleaner or anything similar. Anyway, I've used the CheckSUR tool and attached the log file.

If I recall correctly, this 'not genuine' message only started to pop up after I downloaded and installed a game (CS:GO) from Steam... It took a while to install some directx as well. It's a shot in the dark, not sure if it has anything to do with this.

Also, I found out that if I go to folder System32/WAT and double click WatUX, nothing happens either. :confused:

Thanks Noel. Good Night.
 

Attachments

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
WatUX doesn't actually do much anyhow - you wouldn't normally see anything ;)
The output above is normal

Let's have a look at the Event logs - maybe they'll give us a clue...

Open Event Viewer

click on theWindows logs entry in the left pane to expand it.

Now click on theApplication entry - wait while it loads.

Click on 'File'in the menu bar and select Save...

Save the file asAppevt.evtx

Repeat for theSystem log

then zip both,and upload them.

 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Haha you can tell my Windows knowledge is very limited.. :D

I have attached the Event logs, please kindly find them. I don't know if this helps, but I remember I only started to get the 'not genuine' popup around 13/06 or 14/06.

Thank you.
 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
Thanks for the dates - they do at least mean that I don't need to look at anything before the beginning of March! (there can be a 90-day lag before the system catches something like this).

I see you're using Kingsoft Anti-Virus - is this on its own, or as a companion to another? I can find no significant independent data about its effectiveness as sole AV?
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
The Kingsoft AV is a free Anti-Virus that I've been using for many years, frankly I don't really know how effective it is, but my computer hasn't been infected with any serious viruses since, so I just carried on with it.

But, I probably wouldn't be surprised if it has something to do with this pop-up error, as sometimes this AV tells me that I can speed up my computer by clearing out some of the 'system rubbishes'... and sometimes, I did press the 'clear' button.. :cry: I have a feeling it's the registry problem.
 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
I would tend to agree.
Uninstall Kingsoft for the moment at least, and install Avast - run a full system scan and let me know if it finds anything significant
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Okay, I've uninstalled Kingsoft and run a full system scan with Avast.

It did find some threats and moved them into the chest now, not sure how bad these viruses are, below are their names:

JS:Includer-AWP [Trj]
JS:ScriptXE-inf[Trj]
Win32: Dropper-gen [Drp]
Win32:Agent-AWWS[Trj}
Win32:Malware-gen
Win32:Evo-gen[Susp]
JS:ScriptXE-inf[Trj]
Win32:GenMaliciousA-HO[Trj]
JS:ScriptIP-inf[Trj]


wfiAe1IreKqEAAAAABJRU5ErkJggg==
 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
I cannot claim to be any kind of malware expert!
What I do see there is a number of low-level threats which some AV's tend to avoid.

Please downloadand install Malwarebytes Anti-malware(free version) from http://www.malwarebytes.org/products/malwarebytes_free/- UNtick 'Enable free trial of MBAM Premium' at the end of the installation- and update it, then run a fullscan in your main account, and Quickscans in any other user accounts.



Quarantineeverything it finds
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Ah ok, thanks Noel. :)

I have actually got Malwarebytes installed, and ran a couple of full system scans today. It did find some malwares which have been quarantined now. Not sure if it's fixed the problem, but I haven't seen the pop-up for a few hours now, which means 'progress', right? Although the pop-up does happen very randomly.
 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
Spoke too soon, the error message has come back today right after I turned on the computer. :(
 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
Hmm - I'll have to review this when I'm sober, and see what I can find.
Please post a new set of diagnostic files.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Haha no worries.

Please find the new MGADiag report below. Enjoy the weekend!


Code:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE22
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-XD3V4-QHXT4-PQ926
Windows Product Key Hash: vD4yA91c8xY786Blb/rnQX0zq7U=
Windows Product ID: 00359-OEM-8703827-54272
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {10C5DBFB-4737-4FDD-BA4F-5CAEACBCCB73}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150525-0603
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{10C5DBFB-4737-4FDD-BA4F-5CAEACBCCB73}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-PQ926</PKey><PID>00359-OEM-8703827-54272</PID><PIDType>3</PIDType><SID>S-1-5-21-306632682-3253932108-1278027814</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>4001</Version><SMBIOSVersion major="2" minor="6"/><Date>20120420000000.000000+000</Date></BIOS><HWID>4B6A3A07018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: 586bc076-c93d-429a-afe5-a69fbc644e88
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00174-038-254272-02-2052-7601.0000-1712015
Installation ID: 019405491393123205102430545475614764092626140035191214
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: PQ926
License Status: Licensed
Remaining Windows rearm count: 2
Trusted time: 27/06/2015 12:35:36

Windows Activation Technologies-->
HrOffline: 0x8004FE22
HrOnline: N/A
HealthStatus: 0x0002000000000000
Event Time Stamp: 6:21:2015 17:16
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppuinotify


HWID Data-->
HWID Hash Current: NAAAAAIABAABAAEAAAACAAAAAQABAAEAln0uBHcW4i1iNErd4NvqAhgZVoWygnPYMKmWYw==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG            ALASKA        A M I
  SSDT            IdeRef        IdeTable
  SSDT            IdeRef        IdeTable
  SSDT            IdeRef        IdeTable
  BGRT            ALASKA        A M I
 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
OK - back to first principles - let's have a look at the SPPUINOTIFY registry Key and see if there are any anomalies there...

Open an Elevated Command Prompt, and run the following command

REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\sppuinotify

post the results.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Here are the results,

Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\sppuinotify


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppuinotify
    DisplayName    REG_SZ    @%SystemRoot%\system32\sppuinotify.dll,-103
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServ
ice
    Description    REG_SZ    @%SystemRoot%\system32\sppuinotify.dll,-102
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20
    DependOnService    REG_MULTI_SZ    EventSystem
    ServiceSidType    REG_DWORD    0x1
    RequiredPrivileges    REG_MULTI_SZ    SeChangeNotifyPrivilege\0SeImpersonate
Privilege
    FailureActions    REG_BINARY    80510100000000000000000003000000140000000100
0000E093040001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppuinotify\Security

C:\Windows\system32>
 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
It looks to me as if you may be missing part of the key - the vital Parameters subkey.

I've uploaded a file - jpcaa.zip - to my OneDrive at Noel's OneDrive
Please download and save it to your desktop.

Right-click on the saved file and select Extract all...
Save it to the default location
This should create a file jpcaa.reg

right-click on the file, and select Merge

Accept the warnings, - you should then get a 'Success' message.

Close all windows, and reboot.



Run another MGADiag report, and post the results.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Thank you very much, Noel.

I did everything as instructed above, and below is the MGADiag report. I see the 'Tampered Service' line has gone!!!:D OMG, does this mean the problem is fixed?

P.S I just moved house, so the PC is not connected to internet yet. Currently, I can only get the PC online through the hotspot from my phone. Hope this won't anyhow affect the MGADiag results.

Code:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-XD3V4-QHXT4-PQ926
Windows Product Key Hash: vD4yA91c8xY786Blb/rnQX0zq7U=
Windows Product ID: 00359-OEM-8703827-54272
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {10C5DBFB-4737-4FDD-BA4F-5CAEACBCCB73}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150525-0603
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{10C5DBFB-4737-4FDD-BA4F-5CAEACBCCB73}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-PQ926</PKey><PID>00359-OEM-8703827-54272</PID><PIDType>3</PIDType><SID>S-1-5-21-306632682-3253932108-1278027814</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>4001</Version><SMBIOSVersion major="2" minor="6"/><Date>20120420000000.000000+000</Date></BIOS><HWID>4B6A3A07018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: 586bc076-c93d-429a-afe5-a69fbc644e88
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00174-038-254272-02-2052-7601.0000-1712015
Installation ID: 019405491393123205102430545475614764092626140035191214
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: PQ926
License Status: Licensed
Remaining Windows rearm count: 2
Trusted time: 01/07/2015 17:24:45

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 6:28:2015 18:35
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: NgAAAAIABAABAAEAAAACAAAAAgABAAEAln0uBHcW4i1iNErd4NvqAhgZVoWygnPYMKnLSpZj

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG            ALASKA        A M I
  SSDT            IdeRef        IdeTable
  SSDT            IdeRef        IdeTable
  SSDT            IdeRef        IdeTable
  BGRT            ALASKA        A M I
 

My Computer My Computer

At a glance

Windows 7 Home Premium 64bit
Computer type
PC/Desktop
OS
Windows 7 Home Premium 64bit
Back
Top